My Problem is that i can't route TCP/UPD traffic through the openVPN server, but I receive the DHCP information from the DHCP server which is located on an other machine on the same subnet as the Client and the openVPN server.
Network-Topology:
home (192.168.0.*) ->
-> work-gw(public ip) ->
-> -> openVPNServer (10.0.1.54)
-> -> dhcpServer (10.0.1.1)
-> -> work-net 10.0.1.*
I can establish a connection to the openVPN server, I receive an IP adress and all other information from the DHCP servers IPrange but from there on I can't connect access anything on the same subnet.
Where is the problem I am running into?
The server is bridging between one physical interface and a tap device.
Server: Gentoo
Client: Windows
client conf:
Code: Select all
client
dev tap
proto tcp
remote W.X.Y.Z 41337
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3Code: Select all
port 41337
dev tap0
proto tcp
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
server-bridge
push "route 10.0.1.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3iptables config (server):
iptables -S
Code: Select all
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s W.X.Y.Z/32 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 222 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -j ACCEPT
-A INPUT -p tcp -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -i tap0 -j ACCEPT
-A FORWARD -s 123.123.123.40/32 -j ACCEPT
-A FORWARD -i tap0 -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT
Code: Select all
net.ipv4.ip_forward = 1brigde is forwarding:
Code: Select all
br0
bridge id 8000.000c29a2d457
designated root 8000.000c29a2d457
root port 0 path cost 0
max age 19.99 bridge max age 19.99
hello time 1.99 bridge hello time 1.99
forward delay 14.99 bridge forward delay 14.99
ageing time 299.98
hello timer 0.46 tcn timer 0.00
topology change timer 0.00 gc timer 5.48
flags
eth0 (1)
port id 8001 state forwarding
designated root 8000.000c29a2d457 path cost 2
designated bridge 8000.000c29a2d457 message age timer 0.00
designated port 8001 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
tap0 (2)
port id 8002 state forwarding
designated root 8000.000c29a2d457 path cost 100
designated bridge 8000.000c29a2d457 message age timer 0.00
designated port 8002 forward delay timer 0.00
designated cost 0 hold timer 0.00Code: Select all
Verbindungsspezifisches DNS-Suffix: xyz
Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter V9
Physikalische Adresse . . . . . . : 00-FF-DB-C8-B2-67
DHCP aktiviert. . . . . . . . . . : Ja
Autokonfiguration aktiviert . . . : Ja
Verbindungslokale IPv6-Adresse . :
IPv4-Adresse . . . . . . . . . . : 10.0.1.90(Bevorzugt)
Subnetzmaske . . . . . . . . . . : 255.255.255.0
Lease erhalten. . . . . . . . . . : Donnerstag, 27. September 2012 13:19:53
Lease läuft ab. . . . . . . . . . : Dienstag, 09. Oktober 2012 15:44:13
Standardgateway . . . . . . . . . :
DHCP-Server . . . . . . . . . . . : 10.0.1.1
DNS-Server . . . . . . . . . . . : 10.0.1.1
10.0.1.5
NetBIOS über TCP/IP . . . . . . . : Aktiviert